MalwarePublished 7 Aug 2026

@catamania/front-components (npm) · Malicious Code

Affects @catamania/front-componentsSource GCVE Database

Malicious package : remove @catamania/front-components and rotate any secrets on hosts that installed it.

Data as of 8 Aug 2026, 15:38 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13620

What to do

Remove @catamania/front-components from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@catamania/front-components	Affected =1.0.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @catamania/front-components version 1.0.5 contains malicious code that executes during installation. Its postinstall.js script collects host reconnaissance data such as hostname, username, current working directory, and environment variable names, then sends this information to a hardcoded external URL. The package's main component is benign, indicating the malicious behavior is limited to the install-time script. This behavior suggests a reconnaissance or dependency confusion attack vector.

Impact

The malicious postinstall script leaks host reconnaissance data to an external attacker-controlled endpoint. Although environment variable values are masked, the exposure of host identifiers and environment variable names can aid attackers in profiling the environment for further attacks or supply chain compromise. There is no indication of direct code execution beyond data exfiltration.

Defensive guidance

Users should avoid installing version 1.0.5 of @catamania/front-components. Investigate alternative trusted sources or versions of the package. Monitor for updates from the package maintainers or npm advisories for remediation. Consider auditing postinstall scripts in dependencies before installation.

Summary

The @catamania/front-components npm package version 1.0.5 includes a postinstall.js script that runs automatically upon npm install. This script collects system information including os.hostname(), os.userInfo().username, process.cwd(), and the names of environment variables from process.env. It then sends this data as a JSON payload via HTTPS POST to a hardcoded webhook.site URL. The main index.js exports a trivial Vue button component unrelated to the malicious behavior, consistent with a scoped dependency-confusion or reconnaissance probe designed to identify internal build hosts resolving the @catamania scope to the public registry.

References

npmjs.com/package/@catamania/front-components/v/1.0.5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Aug 2026, 15:38 UTC

Technical details

References

Community reviews